Problem with Routing in VLAN

Question

I am trying to set up several VLAN's on a Cisco 3560 switch. These new segments should be able to communicate with VLAN 1 and even access the Internet.

Basic IP information:

Gateway: 10.1.1.2
VLAN1:   10.1.1.1/24
VLAN2:   10.1.2.1/24
VLAN3:   10.1.3.1/24

I managed to add the VLAN and have network connectivity within the VLAN's but have not been able to get routing to work correctly.

What's working:

1. Hosts in VLAN 1 one can ping the DG and access the internet
2. VLAN 2 & 3 are communicating with each other. Hosts in VLAN2 (e.g. 10.1.2.2) can ping hosts in VLAN3 (e.g. 10.1.3.2) on the same switch
3. Hosts in VLAN 2 & 3 can ping the interface IP of VLAN1 (10.1.1.1)

What's not working:

1. Hosts in VLAN 2 & 3 cannot ping the hosts in VLAN 1 on the same switch, or vice versa.
2. Hosts in VLAN 2 & 3 cannot even ping the DG.

Here is the configuration on the switch:

#sh conf

version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Layer3
!
enable secret 5 $1$3NYq$mDR12iJm5nEorw8oDLDgr1
enable password Cisco
!
no aaa new-model
vtp domain BETA
vtp mode transparent
ip subnet-zero
ip routing
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 2
 name VLAN002
!
vlan 3
 name VLAN003
!
vlan 60
 name Reserved-1
!
interface FastEthernet0/1
!
interface FastEthernet0/2
 switchport access vlan 2
!
interface FastEthernet0/3
 switchport access vlan 3
!
interface FastEthernet0/4
 switchport access vlan 2
!
interface FastEthernet0/5
!
interface FastEthernet0/6
 switchport access vlan 3
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface FastEthernet0/23
!
interface FastEthernet0/24
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 ip address 10.1.1.1 255.255.255.0
!
interface Vlan2
 ip address 10.1.2.1 255.255.255.0
!
interface Vlan3
 ip address 10.1.3.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 10.1.1.2
ip http server
!
!
control-plane
!

#sh vlan br

VLAN Name                             Status    Ports
---- -------------------------------- --------- ------------------------------
1    default                          active    Fa0/1, Fa0/5, Fa0/7, Fa0/8
                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12
                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16
                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20
                                                Fa0/21, Fa0/23, Gi0/1, Gi0/2
2    VLAN002                          active    Fa0/2, Fa0/4
3    VLAN003                          active    Fa0/3, Fa0/6
60   Reserved-1                       active
1002 fddi-default                     act/unsup
1003 token-ring-default               act/unsup
1004 fddinet-default                  act/unsup
1005 trnet-default                    act/unsup



#sh ip route

Gateway of last resort is 10.1.1.2 to network 0.0.0.0

     10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks
C       10.1.3.0/24 is directly connected, Vlan3
C       10.1.2.0/24 is directly connected, Vlan2
C       10.1.1.0/24 is directly connected, Vlan1
S*   0.0.0.0/0 [1/0] via 10.1.1.2

Can someone point out the problem to me please?

Answer 1

Normally, if you have routing enabled on this switch, you should use a routed link to the other router, not a layer-2 connection. The layer-2 connection complicates things. What you should do is set up the interface to the other router with a no switchport command, and place an IP address, like 10.0.0.2 255.255.255.252 on it, and set up the router interface to the switch with 10.0.0.1 255.255.255.252.

Your hosts on VLAN 1 need to have their gateway set to 10.1.1.1, not 10.1.1.2, so that traffic destined for VLANs 2 and 3 doesn't get sent to the other router.

In any case the other router must have routes back to VLANs 2 and 3, so that it knows to send any traffic destined for those networks to the switch. Also, you will need to tell the other router to NAT for those networks, too.